hxxps://app[.]claap[.]io/c-9lrJFpdIoN-x6sKWGk4tFlm?t=197

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/07/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://app.claap.io/c-9lrJFpdIoN-x6sKWGk4tFlm?t=197
Sample260717-e118xaev9t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1748	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287359474565146"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{41628C59-32AC-464F-BF07-DDF64D3543FB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5160 wrote to memory of 4232	5160	msedge.exe	80
PID 5160 wrote to memory of 1900	5160	msedge.exe	82
PID 5160 wrote to memory of 1748	5160	msedge.exe	81
PID 5160 wrote to memory of 1900	5160	msedge.exe	82
PID 5160 wrote to memory of 1900	5160	msedge.exe	82
PID 5160 wrote to memory of 5488	5160	msedge.exe	83
PID 5160 wrote to memory of 5488	5160	msedge.exe	83
PID 5160 wrote to memory of 4820	5160	msedge.exe	85
PID 5160 wrote to memory of 4820	5160	msedge.exe	85
PID 5160 wrote to memory of 4820	5160	msedge.exe	85
PID 5160 wrote to memory of 4740	5160	msedge.exe	86
PID 5160 wrote to memory of 4740	5160	msedge.exe	86
PID 5160 wrote to memory of 4740	5160	msedge.exe	86
PID 5160 wrote to memory of 392	5160	msedge.exe	88
PID 5160 wrote to memory of 392	5160	msedge.exe	88
PID 5160 wrote to memory of 4360	5160	msedge.exe	89
PID 5160 wrote to memory of 4360	5160	msedge.exe	89
PID 5160 wrote to memory of 440	5160	msedge.exe	90
PID 5160 wrote to memory of 440	5160	msedge.exe	90
PID 5160 wrote to memory of 3780	5160	msedge.exe	92
PID 5160 wrote to memory of 3436	5160	msedge.exe	93
PID 3436 wrote to memory of 1760	3436	msedge.exe	94
PID 5160 wrote to memory of 5100	5160	msedge.exe	97
PID 5160 wrote to memory of 5612	5160	msedge.exe	98
PID 5160 wrote to memory of 6136	5160	msedge.exe	99
PID 5160 wrote to memory of 3248	5160	msedge.exe	100
PID 5160 wrote to memory of 3248	5160	msedge.exe	100
PID 5160 wrote to memory of 3632	5160	msedge.exe	102

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://app.claap.io/c-9lrJFpdIoN-x6sKWGk4tFlm?t=197
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffbb11dc188,0x7ffbb11dc194,0x7ffbb11dc1a0
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,1665836111561994127,1508429999047522662,524288 --field-trial-handle=2588,i,17422242802953961100,15002535048236941223,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,6014201824348727491,9847018682011974002,262144 --field-trial-handle=2588,i,17422242802953961100,15002535048236941223,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:2
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,9165115808472491574,2656050946448840994,524288 --field-trial-handle=2588,i,17422242802953961100,15002535048236941223,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:13
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,12103171090511146404,2995908028678831767,2097152 --field-trial-handle=2588,i,17422242802953961100,15002535048236941223,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,2423890970149957717,5141056538540168152,2097152 --field-trial-handle=2588,i,17422242802953961100,15002535048236941223,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,6982572309844859038,1259386832341031755,524288 --field-trial-handle=2588,i,17422242802953961100,15002535048236941223,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:12
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,17559168028573489243,7492878861246554264,524288 --field-trial-handle=2588,i,17422242802953961100,15002535048236941223,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,14187339908257457774,15460970235487467161,524288 --field-trial-handle=2588,i,17422242802953961100,15002535048236941223,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,9556817335131237549,247568795246724227,524288 --field-trial-handle=2588,i,17422242802953961100,15002535048236941223,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,9556817335131237549,247568795246724227,524288 --field-trial-handle=2588,i,17422242802953961100,15002535048236941223,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,16641779948317958345,1581042672552374660,524288 --field-trial-handle=2588,i,17422242802953961100,15002535048236941223,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,17884775614818136195,10738772670922109113,524288 --field-trial-handle=2588,i,17422242802953961100,15002535048236941223,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,16619792664401467426,2065734430506315015,524288 --field-trial-handle=2588,i,17422242802953961100,15002535048236941223,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,16749290803311658716,251420157603627930,524288 --field-trial-handle=2588,i,17422242802953961100,15002535048236941223,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2812,i,7931695401958231371,2291876866258564574,524288 --field-trial-handle=2588,i,17422242802953961100,15002535048236941223,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5572,i,14832639712104054546,12993504960553492441,262144 --field-trial-handle=2588,i,17422242802953961100,15002535048236941223,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

0fba5a71-8592-4d56-bd92-911e5a1e3fe1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0fba5a71-8592-4d56-bd92-911e5a1e3fe1.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1cc50472c36daea9a59918ae6ef3552dd62066fb6ee2302bbc6d4b5102708695
MD5 e959f674d6813e70966aaaf4e5ea8592
SHA1 e9e61980c77101939bbbf7b0bc51533d5536b92c
SHA512 e1017e9769c1f395f086ae32db90585302a1b95890bc09ac0e49ec90d8ce9a54b080f895650fab1e1ab8cffa54a4f1798dfd1a19ca81419ad827dc664830393f
TLSH
T125E02BEEE934AC2714F94B1AA556478AEA50135717C0955F3A3E450C8FB172A428985C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000b1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b1
Size 59KB
SHA256 23e0e0b10ee95619ee1d012f3d2bc98ddd53b881eff4cc9e5a3259e4e56df1eb
MD5 b9cd1508809abedb28db96797dfcef8a
SHA1 c73d7c8b99be3c0164eb1911865678f2b93040e3
SHA512 18cdc7d16d13eb00b005dd418d56b7fa33d68957770db5d111662dd72b3904e8d13f3f0fd46b37ec65fbc2177eadfb541666bba0bcfee42108f3c6e290f7739f
SSDEEP 1536:zKvLOJCGCZTzcxIxr18goCvUNvJ3GSF9YfJ/76sUs:zKvM7qLxp8gHUn2PT
TLSH
T1985302B257A0DC8CE090412F62640FCB1B95A6AD6707E373EF149B2FA3C5705A4DE4B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 d23bbf5ef57f25fe8e767f681fe64644b2c21b3b40125318230ba37aa7f38b0c
MD5 03165a6389c0573f29b550e73f9a93bc
SHA1 801014386c0f006114e93d8491fa23d44b77647b
SHA512 f2b9a53e30b4fadf75652fa0e94ca759b48f04a4d5ff1bd02188ccc63c937721ab3063a5eced82167cb7a0629ba384b8102491135de82ec2df649b8ffa79432e
SSDEEP 96:ic/l2FTUhgB6YcXOpoIO9UYIQjg94XmUv4M6vwT9nLfy:ic/cFwK6XX8oIO9UYIQkfy6ehfy
TLSH
T121D191019AF27B4FEB5B52B3A1C12A64B17C446DCA737E273344E1362806FC9DDA7108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ef5c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ef5c.TMP
Size 3KB
SHA256 954bc38c5f9395bc3579c8214dd9c114f5a9e1720b6d45092863e4c157ce47ea
MD5 5826ea241ab3c35a9507d9aa25c1d556
SHA1 fbad6f53f7e20dbd696fd8fff1e134840e2f8442
SHA512 d657be3dd5c03d43c5237e33b8007644f1f752d904d05471c6010624a1c914193cd140714683820390ba767a6ecedae5c22382a59f23089a44fabebc0aca49d7
TLSH
T14171B91506F3399FF3632133E1D16158F0FC856DCE737D570B98497A261AB21DC62518
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 36123bbbf29219edf6e053511c4c2f85ecd15f525716f665af90dc55a456eedf
MD5 a9c7390e1477606751d057a5225cedb5
SHA1 c524d71832e3d78951c5495450fc0e66ab181964
SHA512 26b00836b532ee28cc9231e8c28fb7e0cbdcacb41a8dcbf0965a9ab3a3e64ac077dbde79d506786c81bd96b5a1e0585005d829c684355c9e6be05c0fb901f5c1
SSDEEP 192:D1bL9009ON2heK0eAUUtUcaaij6+Qimo7OCoRqJahg45ElIV2u8RFwC9F5SnoytH:D139009ON2heK0eAhtUcaaiG+Qimo7O9
TLSH
T1AB1258F7C3F4866ECA1162F4EA183B2BCE190515425C3D5AC5E4EF0BA3E2471E251B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b72d5dddfdd529db8369faebdc8f46480358da17493da4cd774e69c747f23a50
MD5 35663d4ce7edea200c24326557d357a5
SHA1 146fd041fd27729e1ac1b4dab79c8e8df9d9a27c
SHA512 7f58a5596c1b9dac357bec8bb5f4734037b5613bf8f657aade0d4bbe6eebcc4533404f2598d765e957c8835c9e83266901741c5aad6f87b3c6d3941a172a6c0c
SSDEEP 192:sxZlRbyMqZjK1Ml8UQsFR/fZszqE0CXUizodpZlj/W6+WN4fE/Y0dXCOyDIg56kJ:sxZlQq6R/fZszV0LZP/b7/5L48o
TLSH
T12B62F9166A38697BDCDBD219F9457B93D3F9152392801E44AAFCCF0C04E6AED211782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 120b68c692f4fa54f9ed0e8b354b1580dcd3b6266123aeeb43cb855d1749a1b3
MD5 9a3adae0f9ec2d162cbc64bda7b76ded
SHA1 01c2d6ead6241a305e894bae2f51eb4037c74372
SHA512 f82ba7e7230bfb1adef703266f193868d4a8a467de67ada2bc3ef03ec7408259c78d6dce9c80236eec94bd36067f59c8f3efdae07be42c6752d936a8a25d795d
SSDEEP 192:sxZlRbyMqZjK1Ml8MFR/fZs8PMxE0CXU+zodpZlj/W6+WN4fE/Y0dhWydIgjkJ:sxZlgdR/fZs8PM60LlP/b7/56gjo
TLSH
T1DF62FA166A38597BDCDBD219FA457F93D3F9152392800E44AAFCCA0C04E76EC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4c031dac4c9c4c7dcb4757ddbb5d6fa674239b87d827ce36d2f7652abd724dde
MD5 e964744cb884040f6db9b52cbbb67788
SHA1 f8baaa5dab3458e3af76dc857b2a3c4689240976
SHA512 64bf2dd71480b1467591b2f970f3a90cf2a3555a6c177c7f7abdb22a3a1fc589b2a5e323ee9284f7a79ef404fedbad7dbdb8f069bf0402a974d3e1aa2ca8215d
SSDEEP 192:sxZlRbyMqZjK1Ml8MFR/fZszqE0CXUizodpZlj/W6+WN4fE/Y0dXC6yDIg56kJ:sxZlQdR/fZszV0LZP/b7/5H48o
TLSH
T19D620A166A386D7BDCDBD219F9457F93D3F9152392801E449AFC8B0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 203cce1c4bb7086bf045d43912169a83adc65717c7b46dd51e88ab586e835b9e
MD5 c9821a650e1491ab2fab27fefc745a82
SHA1 3ea8a2b8ff01a01991c000fb740f506901f57279
SHA512 ec28c1925e34ca9914b2b22b4d8ebdbc04e95fecb3a0206730cad06b2a23429bff4d7e4a301a29b943a6e02bb5e5710113a1d59e8c719f29fe83597336591358
SSDEEP 768:ciWKy8Eq2+dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TQLl/Ck0sg3ro1A:ciWKy8Eq2+dWRm5rQW7u1jaKTQLpCFsy
TLSH
T117E21A2B280CCB7E4F841E5CEC266F966EE8018B66A84D5447FA494C03C77EB511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 61a4b283a2f3fb8e91eede1a0b7fdad4b962b9b8ad14e26cf3edeb6af04f6a55
MD5 a5571422f96b2f89a288446e3fa5f1d4
SHA1 0ab05082a42ce9d92aedc048fd7eebba6055e045
SHA512 f191ded5b28e43b10bfaae6ebd4338b8fecd2087a0ff0b92499e245f3fcf289d6a8eead34355c790ba6b83e09d34c8fedda672c2ec78ca0515f9325c520ed52f
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7411ONSeEwsM:AFBHhTofhno2mB21q3Llbfe3sLDdeEpT
TLSH
T1D9B28E52717B12023C3E290CA7A19B371F8272A33558A96F77B800BA4E67E515DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6e12af9b534b1afd4e9bea9b4cbdbf7852f89d91a26ea0c212d6fd90899cf180
MD5 13e10c082e02e234f7c5ecadbb2f8c0f
SHA1 a263fed0a83caf808291c8d6e05816380e55a859
SHA512 1a2105c9b42545b04a8aa303736e7cec23e2547ff21c35aec5f42ad97d6c8e41f8f652b97de42b0202016bb8e958e5d61bc028bf0f55da0aacbfc6ed98fc5e1c
SSDEEP 384:npiFztNn/s3n9SW38N78TUNTUlIR+ytbD9jkpfb7oBuJAOkaGxOObjI9G6w7oAHl:AFzj+9134wgnKJo4wZx29Mos
TLSH
T102D24B32EC54DEB7ACE74ED5B75A3A07EEE00253868C5AD4D6D86D4C00CB5AD930BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 30890d68fdb73d3dae64269ed94bb8b24d2b2dc52122692b6ba0c03aa649e9b6
MD5 f3cc5b8aa084865f7e06b5c568dff2c8
SHA1 5cc337975edd1909a527ca2cbb7fb1fbdbf1440f
SHA512 854dcab2876d3e316a51a6ebe5bb48a4bbbc3dac7db1a8f853e02562ee66c36fb42a281ca0412b07af2c7cd30cea68c4e8a16dbbedbcaad3bceb8a9ff96154e9
SSDEEP 384:n5piF9CcmyWCs38N78TUNTUlIRJytbD9jkpfb7oBuJAOkaQxhkP+lFYS/D4Hy/7V:WFccps34wg4KJo4whxhkoFYS/l
TLSH
T1BBC23A32EC94CEA7ECE64AD9A64A3947EEE0016386885AD4DAD81D1D00DF1ED530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e4f3c4f9b2f6871c05d74fb52dc6c90ca62eb1318985d91271792b17e255d771
MD5 03c389be446f5405d4dfcb5782344787
SHA1 65e0d26c308dad7b3337a31521ed0abec4c63f9f
SHA512 2f715de0346be1ef2d6a28cdf40d78c9f4404f915efd4bf654a53ced2fb60db57a750c02f5b05bf2267cb4b943296d48caf65e726cce99d3ce10816ae9ffb858
SSDEEP 384:n3iFztNn/s3n9SB38N78TUNTUlIR+ytbD9jkpfb7oBuJAOkaQxOObjI9G6w7oAHl:yFzj+9834wgnKJo4whx29Mos
TLSH
T1A5D24B32EC54DEB7ACE74ED5B75A3A07EEE00253868C5AD4D5D86D4C00CB5AD530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bb907e2c372ab17228d43fdcd9233544b2755d9beeab812e28661296538ca031
MD5 ec4d4865735887b4aa073a5b42a33d19
SHA1 6b6a4f1f7c14da3c7d651e2caa661cb2192d7db7
SHA512 bcfa1932ead1bee8a3a6470d72e90668f6c7cc7ad64f363c81b627e0fcdea75020d2c5c38019f508fdf79caaea01a0be8c64fafbfe3f006168561cb6d827481a
SSDEEP 384:n5piFzCcmyWCp38N78TUNTUlIRJytbD9jkpfb7oBuJAOkaQxhkP+lFYS/D4Hy/7V:WFGcpp34wg4KJo4whxhkoFYS/l
TLSH
T187C24B32EC94CEB7ECE74AD9A75A3947DEE0016386885AD4DAD81D1D00DF1ED530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3cb99237dc369004c043bf299720f25467e98dbcda11f9e7351979dd093ff09e
MD5 c92d244e4f700748b1c72c43c5d192d3
SHA1 d2924fdc8e80ef77d6651345976e41a586590d86
SHA512 5c395384c772f508da72a938cf5cde051778c537e27ec455e92bb08379eea22ca70fbc0a318be66a0bb9267f66cacc4fbeaac71d92dcc4a952505f0a991ad108
SSDEEP 384:n5eiF9CcmyWCs38Nv8TUNTUlIxBydIjujkpfb7oBuJAOkaqxhkP+lFYS/D4Hy/7c:vFccps3IwgR3Jo4wlxhkoFYS/s
TLSH
T1C9C24B32EC98CEA7ECD64ED5E74A3947EEE00163868C5AD4DAC81D5D00DF1AD530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 07dd93f5faf6ab2298b6b267f1aaec19ae61f885c693576f9a87c13855e70ffd
MD5 d53297fc246e90ecd53434a6ce279599
SHA1 a7b337895149f0780ea89ec6d43f1482c0f5fe6b
SHA512 9b0d9b879108b86aa4d3cbc0ef482c93f642df126a7862d0b95bbfd4c1996386e98c622076e52b8bbe9394732c6ea18ef4f15765c0b9115545e09710808bb98f
SSDEEP 384:n5iiF9CcmyWCs38Np8TUNTUlIxBydvko1ajkpfb7oBuJAOkBshkP+lFYS/D4Hy/Y:/Fccps3CwgBC7Jo4wBshkoFYS/s
TLSH
T1FBC23B36EC98CAB7EDEB4FD9E74E7A06EEE0016385885AD4DAD81D0D00DB19D1307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4f1360eb989bcb767d514f2b11531c955f1b093a835602947394875b135ebcb2
MD5 17ea576614dc4c64b5bb8fb7be7bccf7
SHA1 c5ce77cff831c242f8b48c029224c176b3480bcb
SHA512 0e21de47d9d967aac2e9066b2158289f64c6d0f5f81efdda6952353c0e2666db2b08937261511a8185b8577a7e3c2a86042b4442f7936ccd104e9a876451dabd
SSDEEP 384:n5piFztNn/s3n9SB38N78TUNTUlIR+ytbD9jkpfb7oBuJAOkaQxOObjI9G6w7oAF:WFzj+9834wgnKJo4whx29Mos
TLSH
T1FAD23A32EC54DEB7ACE74ED5B75A3A07EEE00263868C5AD4D5D86D4C00CB5AD530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3780-694-0x0000025842430000-0x0000025843430000-memory.dmp

Download